managed-deepagents 0.6.2-dev.8 → 0.7.0

package/dist/channels/trigger/http.js

@@ -1,17 +1,33 @@
 import { randomUUID } from "node:crypto";
 import { v5 as uuidv5 } from "uuid";
+import { missingWorkspaceConnectionSlug } from "../../agent-auth.js";
 import { extractAssistantText } from "../assistant-text.js";
 import { logger } from "../../runtime/log.js";
 import { observeIngressAgent, resumeIngressAgent, scheduleIngressWork, startIngressAgent, } from "../../ingress/index.js";
 import { createTriggerClient, LANGSMITH_MDA_TRIGGER_SERVER_URL_ENV, TriggerClientError, } from "./client.js";
+import { IdentityContextUnavailableError, InvalidIdentityContextError, principalIdFromIdentityContext, } from "./identity-context.js";
 import { parseTriggerChannelEvent, TRIGGER_SERVICE_KEY_HEADER, } from "./types.js";
 export { TRIGGER_SERVICE_KEY_HEADER } from "./types.js";
 export const ASSISTANT_ID_ENV = "MDA_ASSISTANT_ID";
+class MissingIdentityContextError extends Error {
+    name = "MissingIdentityContextError";
+}
+/** Every delivery requires a verified Agent Auth principal. */
+async function resolveEventPrincipal(event, verify) {
+    const token = event.identity_context;
+    if (token == null || !token.trim()) {
+        throw new MissingIdentityContextError();
+    }
+    return await principalIdFromIdentityContext(token, verify);
+}
 /** Validate one Trigger message, start its run, and enqueue observation. */
 export async function handleTriggerChannelEventRequest(request, options) {
     if (!request.headers.get(TRIGGER_SERVICE_KEY_HEADER)?.trim()) {
         return Response.json({ error: "unauthorized" }, { status: 401 });
     }
+    // Trigger signs x-service-key as a platform service JWT; presence-only is
+    // still a prototype gate. identity_context below is EdDSA-verified against
+    // LangSmith JWKS so forged principals cannot ride a blank/any service key.
     let event;
     try {
         const raw = await requestBody(request, options.rawBody);
@@ -21,6 +37,25 @@ export async function handleTriggerChannelEventRequest(request, options) {
         logger.warn("invalid channel event");
         return Response.json({ error: "invalid channel event" }, { status: 400 });
     }
+    let userId;
+    try {
+        userId = await resolveEventPrincipal(event, options.identityContext);
+    }
+    catch (error) {
+        if (error instanceof MissingIdentityContextError) {
+            logger.warn("missing channel identity_context");
+            return Response.json({ error: "missing channel identity_context" }, { status: 400 });
+        }
+        if (error instanceof IdentityContextUnavailableError) {
+            logger.error(`channel identity_context unavailable (${logger.safeErrorLabel(error)})`);
+            return Response.json({ error: "identity_context verification unavailable" }, { status: 503 });
+        }
+        if (error instanceof InvalidIdentityContextError) {
+            logger.warn(`invalid channel identity_context (${logger.safeErrorLabel(error)})`);
+            return Response.json({ error: "invalid channel identity_context" }, { status: 400 });
+        }
+        throw error;
+    }
     logger.info(`Channel incoming event (type=${event.type}, event_id=${logger.logIdentifier(event.event_id)}, delivery_id=${logger.logIdentifier(event.delivery_id)}, channel_id=${logger.logIdentifier(event.channel_id)})`);
     let client = options.triggerClient;
     if (!client) {
@@ -52,6 +87,7 @@ export async function handleTriggerChannelEventRequest(request, options) {
             assistantId,
             sourceProvider: options.sourceProvider,
             sourceThreadKey: event.source_thread_key,
+            userId,
         };
         started =
             event.type === "message"
@@ -73,6 +109,9 @@ export async function handleTriggerChannelEventRequest(request, options) {
         started,
         client,
         observeAgent: options.observeAgent,
+        sourceProvider: options.sourceProvider,
+        sourceThreadKey: event.source_thread_key,
+        userId,
     }), {
         label: "Channel run observation",
         schedule: options.schedule,
@@ -81,9 +120,9 @@ export async function handleTriggerChannelEventRequest(request, options) {
 }
 async function observeAcceptedRun(input) {
     const { event, started, client } = input;
-    const lifecycle = (type, interrupts) => {
+    const lifecycle = (type, interrupts, message) => {
         logger.info(`Channel outgoing event (type=${type}, delivery_id=${logger.logIdentifier(event.delivery_id)}, channel_id=${logger.logIdentifier(event.channel_id)}, run_id=${logger.logIdentifier(started.runId)})`);
-        return bestEffort(client.postRuntimeEvent(event.channel_id, runtimeEvent(type, event, started, interrupts)));
+        return bestEffort(client.postRuntimeEvent(event.channel_id, runtimeEvent(type, event, started, interrupts, message)));
     };
     await lifecycle("run.started");
     let observed;
@@ -91,10 +130,13 @@ async function observeAcceptedRun(input) {
         observed = await (input.observeAgent ?? observeIngressAgent)({
             threadId: started.threadId,
             runId: started.runId,
+            sourceProvider: input.sourceProvider,
+            sourceThreadKey: input.sourceThreadKey,
+            userId: input.userId,
         });
     }
-    catch {
-        await lifecycle("run.failed");
+    catch (error) {
+        await lifecycle("run.failed", undefined, missingConnectionFailureMessage(error));
         return;
     }
     if (isInterruptedRun(observed)) {
@@ -113,7 +155,7 @@ async function observeAcceptedRun(input) {
         logger.info(`Channel outgoing action (type=post, delivery_id=${logger.logIdentifier(event.delivery_id)}, channel_id=${logger.logIdentifier(event.channel_id)}, run_id=${logger.logIdentifier(started.runId)})`);
         const action = await bestEffort(client.postAction(event.channel_id, {
             type: "post",
-            action_id: randomUUID(),
+            action_id: event.event_id,
             address: event.address,
             source_thread_key: event.source_thread_key,
             message: { text },
@@ -125,7 +167,7 @@ async function observeAcceptedRun(input) {
     }
     await lifecycle("run.completed");
 }
-function runtimeEvent(type, event, started, interrupts) {
+function runtimeEvent(type, event, started, interrupts, message) {
     return {
         id: randomUUID(),
         type,
@@ -134,9 +176,17 @@ function runtimeEvent(type, event, started, interrupts) {
         address: event.address,
         run_thread_id: started.threadId,
         run_id: started.runId,
+        ...(message ? { message: { text: message } } : {}),
         ...(interrupts?.length ? { interrupts } : {}),
     };
 }
+function missingConnectionFailureMessage(error) {
+    const slug = missingWorkspaceConnectionSlug(String(error));
+    if (slug === undefined) {
+        return undefined;
+    }
+    return `This agent can't respond because the \`${slug}\` connection isn't configured. An agent developer can configure it with \`mda connections create ${slug} --project <project>\`, then try again.`;
+}
 function triggerThreadId(sourceThreadKey) {
     return uuidv5(sourceThreadKey, uuidv5.URL);
 }

package/dist/channels/trigger/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/channels/trigger/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,GAGlB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,mBAAmB,EACnB,oCAAoC,EACpC,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAM3B,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExD,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAkCnD,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAgB,EAChB,OAAkC;IAElC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,KAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,CAAC,IAAI,CACT,gCAAgC,KAAK,CAAC,IAAI,cAAc,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAC9M,CAAC;IAEF,IAAI,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,GAAG,mBAAmB,CAAC;gBAC3B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,CAAC,KAAK,CACV,wCAAwC,oCAAoC,sCAAsC,CACnH,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,wCAAwC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CACxE,CAAC;YACF,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,qCAAqC,EAAE,EAChD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,gBAAgB,oBAAoB,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAC9C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG;YACb,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAClD,WAAW;YACX,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,eAAe,EAAE,KAAK,CAAC,iBAAiB;SACzC,CAAC;QACF,OAAO;YACL,KAAK,CAAC,IAAI,KAAK,SAAS;gBACtB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC;oBAC9C,GAAG,MAAM;oBACT,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;iBAC/B,CAAC;gBACJ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC,CAAC;oBAChD,GAAG,MAAM;oBACT,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM;iBACjC,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,qCAAqC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CACrE,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAC7C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,mBAAmB,CACjB,GAAG,EAAE,CACH,kBAAkB,CAAC;QACjB,KAAK;QACL,OAAO;QACP,MAAM;QACN,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,EACJ;QACE,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CACF,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EACtD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAKjC;IACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzC,MAAM,SAAS,GAAG,CAChB,IAAoC,EACpC,UAAsC,EACtC,EAAE;QACF,MAAM,CAAC,IAAI,CACT,gCAAgC,IAAI,iBAAiB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CACrM,CAAC;QACF,OAAO,UAAU,CACf,MAAM,CAAC,gBAAgB,CACrB,KAAK,CAAC,UAAU,EAChB,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAC/C,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;IAC/B,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC;YAC3D,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,CACb,iBAAiB,EACjB,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,CACtC,CAAC,KAAK,EAAoC,EAAE,CAC1C,QAAQ,CAAC,KAAK,CAAC;YACf,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;YAC5B,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC1B,OAAO,IAAI,KAAK,CACnB,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAC/B,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;IACF,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CACT,mDAAmD,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CACnM,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE;YAClC,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,UAAU,EAAE;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,OAAO,EAAE,EAAE,IAAI,EAAE;SAClB,CAAC,CACH,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CACnB,IAAoC,EACpC,KAA0B,EAC1B,OAA0B,EAC1B,UAAsC;IAEtC,OAAO;QACL,EAAE,EAAE,UAAU,EAAE;QAChB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,OAAO,CAAC,QAAQ;QAC/B,MAAM,EAAE,OAAO,CAAC,KAAK;QACrB,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,eAAuB;IAC9C,OAAO,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA4B;IACtD,OAAO,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAgB,EAChB,OAAwC;IAExC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,IAAI,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,UAAU,CAAI,OAAmB;IAC9C,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CACT,WAAW,KAAK,CAAC,SAAS,mBACxB,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,MAAM,GAC1D,GAAG,CACJ,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,yEAAyE;IACzE,8CAA8C;IAC9C,OAAO,QAAQ,CAAC,MAAM,KAAK,aAAa,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,YAAY,CAAC,MAAe;IACnC,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,mEAAmE;AACnE,SAAS,gBAAgB,CAAC,MAAe;IACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/channels/trigger/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,GAGlB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,mBAAmB,EACnB,oCAAoC,EACpC,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,GAE/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAM3B,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExD,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAyCnD,MAAM,2BAA4B,SAAQ,KAAK;IACpC,IAAI,GAAG,6BAA6B,CAAC;CAC/C;AAED,+DAA+D;AAC/D,KAAK,UAAU,qBAAqB,CAClC,KAA0B,EAC1B,MAAqC;IAErC,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACrC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,2BAA2B,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,8BAA8B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAgB,EAChB,OAAkC;IAElC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAE3E,IAAI,KAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,2BAA2B,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YAChD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAC7C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,+BAA+B,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,CACV,yCAAyC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CACzE,CAAC;YACF,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,2CAA2C,EAAE,EACtD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,2BAA2B,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CACT,qCAAqC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CACrE,CAAC;YACF,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAC7C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,CAAC,IAAI,CACT,gCAAgC,KAAK,CAAC,IAAI,cAAc,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAC9M,CAAC;IAEF,IAAI,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,GAAG,mBAAmB,CAAC;gBAC3B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,CAAC,KAAK,CACV,wCAAwC,oCAAoC,sCAAsC,CACnH,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,wCAAwC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CACxE,CAAC;YACF,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,qCAAqC,EAAE,EAChD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,gBAAgB,oBAAoB,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAC9C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG;YACb,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAClD,WAAW;YACX,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,eAAe,EAAE,KAAK,CAAC,iBAAiB;YACxC,MAAM;SACP,CAAC;QACF,OAAO;YACL,KAAK,CAAC,IAAI,KAAK,SAAS;gBACtB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC;oBAC9C,GAAG,MAAM;oBACT,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;iBAC/B,CAAC;gBACJ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC,CAAC;oBAChD,GAAG,MAAM;oBACT,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM;iBACjC,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,qCAAqC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CACrE,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAC7C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,mBAAmB,CACjB,GAAG,EAAE,CACH,kBAAkB,CAAC;QACjB,KAAK;QACL,OAAO;QACP,MAAM;QACN,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,KAAK,CAAC,iBAAiB;QACxC,MAAM;KACP,CAAC,EACJ;QACE,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CACF,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EACtD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAQjC;IACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzC,MAAM,SAAS,GAAG,CAChB,IAAoC,EACpC,UAAsC,EACtC,OAAgB,EAChB,EAAE;QACF,MAAM,CAAC,IAAI,CACT,gCAAgC,IAAI,iBAAiB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CACrM,CAAC;QACF,OAAO,UAAU,CACf,MAAM,CAAC,gBAAgB,CACrB,KAAK,CAAC,UAAU,EAChB,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CACxD,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;IAC/B,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC;YAC3D,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,CACb,YAAY,EACZ,SAAS,EACT,+BAA+B,CAAC,KAAK,CAAC,CACvC,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,CACb,iBAAiB,EACjB,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,CACtC,CAAC,KAAK,EAAoC,EAAE,CAC1C,QAAQ,CAAC,KAAK,CAAC;YACf,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;YAC5B,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC1B,OAAO,IAAI,KAAK,CACnB,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAC/B,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;IACF,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CACT,mDAAmD,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CACnM,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE;YAClC,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,OAAO,EAAE,EAAE,IAAI,EAAE;SAClB,CAAC,CACH,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CACnB,IAAoC,EACpC,KAA0B,EAC1B,OAA0B,EAC1B,UAAsC,EACtC,OAAgB;IAEhB,OAAO;QACL,EAAE,EAAE,UAAU,EAAE;QAChB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,OAAO,CAAC,QAAQ;QAC/B,MAAM,EAAE,OAAO,CAAC,KAAK;QACrB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,KAAc;IACrD,MAAM,IAAI,GAAG,8BAA8B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,0CAA0C,IAAI,qGAAqG,IAAI,yCAAyC,CAAC;AAC1M,CAAC;AAED,SAAS,eAAe,CAAC,eAAuB;IAC9C,OAAO,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA4B;IACtD,OAAO,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAgB,EAChB,OAAwC;IAExC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,IAAI,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,UAAU,CAAI,OAAmB;IAC9C,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CACT,WAAW,KAAK,CAAC,SAAS,mBACxB,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,MAAM,GAC1D,GAAG,CACJ,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA4B;IACpD,yEAAyE;IACzE,8CAA8C;IAC9C,OAAO,QAAQ,CAAC,MAAM,KAAK,aAAa,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,YAAY,CAAC,MAAe;IACnC,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,mEAAmE;AACnE,SAAS,gBAAgB,CAAC,MAAe;IACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC"}

package/dist/channels/trigger/identity-context.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Verify Trigger Server `identity_context` JWTs into Agent Auth principal ids.
+ *
+ * Agent Auth signs these with the LangSmith EdDSA JWKS published at
+ * `{LANGSMITH_ENDPOINT}/.well-known/jwks.json`. MDA verifies the signature
+ * (and typ/version/aud/iss/exp/principal UUID) before stamping `x-mda-user-id`.
+ * Delivery still requires Trigger's `x-service-key` header; signature verify is
+ * what stops a forged principal when that gate is weak.
+ */
+import { type JWTVerifyGetKey } from "jose";
+export declare const IDENTITY_CONTEXT_TOKEN_TYP = "identity-context+jwt";
+export declare const IDENTITY_CONTEXT_AUDIENCE = "mda";
+export declare const IDENTITY_CONTEXT_VERSION = "1";
+export declare const IDENTITY_CONTEXT_ALGORITHMS: readonly ["EdDSA"];
+export declare class InvalidIdentityContextError extends Error {
+    readonly name = "InvalidIdentityContextError";
+    constructor(message: string);
+}
+/** JWKS / network failure while verifying identity_context. Callers should 5xx. */
+export declare class IdentityContextUnavailableError extends Error {
+    readonly name = "IdentityContextUnavailableError";
+    constructor(message: string);
+}
+export interface IdentityContextVerifyOptions {
+    /**
+     * Override key resolution (unit tests). When set, skips the remote LangSmith
+     * JWKS fetch.
+     */
+    getKey?: JWTVerifyGetKey;
+    /** Override expected `iss` (defaults to {@link resolveIdentityContextIssuer}). */
+    issuer?: string;
+    env?: NodeJS.ProcessEnv;
+}
+/** LangSmith API origin used as identity-context `iss` and JWKS host. */
+export declare function resolveIdentityContextIssuer(env?: NodeJS.ProcessEnv): string;
+/** Public JWKS URL for Agent Auth identity-context signatures. */
+export declare function resolveIdentityContextJwksUrl(env?: NodeJS.ProcessEnv): string;
+/**
+ * Extract the Agent Auth principal UUID from a Trigger `identity_context` JWT.
+ *
+ * @throws {InvalidIdentityContextError} when the token is missing, malformed,
+ *   or fails signature / claim checks.
+ */
+export declare function principalIdFromIdentityContext(token: string, options?: IdentityContextVerifyOptions): Promise<string>;
+/** Resolve a principal id from an optional event field; `undefined` when absent. */
+export declare function optionalPrincipalIdFromIdentityContext(token: string | null | undefined, options?: IdentityContextVerifyOptions): Promise<string | undefined>;
+//# sourceMappingURL=identity-context.d.ts.map

package/dist/channels/trigger/identity-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-context.d.ts","sourceRoot":"","sources":["../../../src/channels/trigger/identity-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,MAAM,CAAC;AAKd,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AACjE,eAAO,MAAM,yBAAyB,QAAQ,CAAC;AAC/C,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAC5C,eAAO,MAAM,2BAA2B,YAAI,OAAO,CAAU,CAAC;AAS9D,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,IAAI,iCAAiC;IAE9C,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED,mFAAmF;AACnF,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,qCAAqC;IAElD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,yEAAyE;AACzE,wBAAgB,4BAA4B,CAC1C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAMR;AAED,kEAAkE;AAClE,wBAAgB,6BAA6B,CAC3C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAER;AAED;;;;;GAKG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,MAAM,CAAC,CA2FjB;AAED,oFAAoF;AACpF,wBAAsB,sCAAsC,CAC1D,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW7B"}

package/dist/channels/trigger/identity-context.js

@@ -0,0 +1,171 @@
+/**
+ * Verify Trigger Server `identity_context` JWTs into Agent Auth principal ids.
+ *
+ * Agent Auth signs these with the LangSmith EdDSA JWKS published at
+ * `{LANGSMITH_ENDPOINT}/.well-known/jwks.json`. MDA verifies the signature
+ * (and typ/version/aud/iss/exp/principal UUID) before stamping `x-mda-user-id`.
+ * Delivery still requires Trigger's `x-service-key` header; signature verify is
+ * what stops a forged principal when that gate is weak.
+ */
+import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify, } from "jose";
+import { JWKS_HTTP_TIMEOUT_MS } from "../../runtime/http.js";
+import { normalizeUuid } from "./uuid.js";
+export const IDENTITY_CONTEXT_TOKEN_TYP = "identity-context+jwt";
+export const IDENTITY_CONTEXT_AUDIENCE = "mda";
+export const IDENTITY_CONTEXT_VERSION = "1";
+export const IDENTITY_CONTEXT_ALGORITHMS = ["EdDSA"];
+const DEFAULT_LANGSMITH_ENDPOINT = "https://api.smith.langchain.com";
+/** Remote JWKS key sets, cached per URI for the process lifetime. */
+const jwksCache = new Map();
+export class InvalidIdentityContextError extends Error {
+    name = "InvalidIdentityContextError";
+    constructor(message) {
+        super(message);
+    }
+}
+/** JWKS / network failure while verifying identity_context. Callers should 5xx. */
+export class IdentityContextUnavailableError extends Error {
+    name = "IdentityContextUnavailableError";
+    constructor(message) {
+        super(message);
+    }
+}
+/** LangSmith API origin used as identity-context `iss` and JWKS host. */
+export function resolveIdentityContextIssuer(env = process.env) {
+    const raw = env.LANGSMITH_ENDPOINT?.trim() ||
+        env.LANGCHAIN_ENDPOINT?.trim() ||
+        DEFAULT_LANGSMITH_ENDPOINT;
+    return raw.replace(/\/+$/, "");
+}
+/** Public JWKS URL for Agent Auth identity-context signatures. */
+export function resolveIdentityContextJwksUrl(env = process.env) {
+    return `${resolveIdentityContextIssuer(env)}/.well-known/jwks.json`;
+}
+/**
+ * Extract the Agent Auth principal UUID from a Trigger `identity_context` JWT.
+ *
+ * @throws {InvalidIdentityContextError} when the token is missing, malformed,
+ *   or fails signature / claim checks.
+ */
+export async function principalIdFromIdentityContext(token, options = {}) {
+    const value = token.trim();
+    if (!value) {
+        throw new InvalidIdentityContextError("identity_context is blank");
+    }
+    let header;
+    try {
+        header = decodeProtectedHeader(value);
+    }
+    catch {
+        throw new InvalidIdentityContextError("identity_context is not a JWT");
+    }
+    if (header.typ !== IDENTITY_CONTEXT_TOKEN_TYP) {
+        throw new InvalidIdentityContextError(`identity_context typ must be ${IDENTITY_CONTEXT_TOKEN_TYP}`);
+    }
+    if (header.alg !== "EdDSA") {
+        throw new InvalidIdentityContextError("identity_context alg must be EdDSA");
+    }
+    const env = options.env ?? process.env;
+    const issuer = options.issuer ?? resolveIdentityContextIssuer(env);
+    const getKey = options.getKey ?? remoteJwks(env);
+    let claims;
+    try {
+        const verified = await jwtVerify(value, getKey, {
+            issuer,
+            audience: IDENTITY_CONTEXT_AUDIENCE,
+            algorithms: [...IDENTITY_CONTEXT_ALGORITHMS],
+            typ: IDENTITY_CONTEXT_TOKEN_TYP,
+            requiredClaims: ["exp"],
+        });
+        claims = verified.payload;
+    }
+    catch (error) {
+        if (error instanceof InvalidIdentityContextError ||
+            error instanceof IdentityContextUnavailableError) {
+            throw error;
+        }
+        if (isIdentityContextUnavailable(error)) {
+            throw new IdentityContextUnavailableError("identity_context JWKS verification is unavailable");
+        }
+        const detail = error instanceof Error ? error.message : String(error);
+        const code = error && typeof error === "object" && "code" in error
+            ? String(error.code)
+            : "";
+        if (code === "ERR_JWT_EXPIRED" || /expir|"exp"|claim.*exp/i.test(detail)) {
+            throw new InvalidIdentityContextError("identity_context is expired");
+        }
+        if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED" &&
+            /required.*exp|"exp"/i.test(detail)) {
+            throw new InvalidIdentityContextError("identity_context is missing exp");
+        }
+        throw new InvalidIdentityContextError("identity_context signature verification failed");
+    }
+    if (typeof claims.exp !== "number") {
+        throw new InvalidIdentityContextError("identity_context is missing exp");
+    }
+    if (claims.version !== IDENTITY_CONTEXT_VERSION) {
+        throw new InvalidIdentityContextError(`identity_context version must be ${IDENTITY_CONTEXT_VERSION}`);
+    }
+    const fromPrincipal = principalIdClaim(claims.principal);
+    const fromSubject = typeof claims.sub === "string" ? normalizeUuid(claims.sub) : undefined;
+    if (fromPrincipal && fromSubject && fromPrincipal !== fromSubject) {
+        throw new InvalidIdentityContextError("identity_context principal.id and sub disagree");
+    }
+    const principalId = fromPrincipal ?? fromSubject;
+    if (!principalId) {
+        throw new InvalidIdentityContextError("identity_context is missing a principal UUID");
+    }
+    return principalId;
+}
+/** Resolve a principal id from an optional event field; `undefined` when absent. */
+export async function optionalPrincipalIdFromIdentityContext(token, options = {}) {
+    if (token == null) {
+        return undefined;
+    }
+    if (typeof token !== "string") {
+        throw new InvalidIdentityContextError("identity_context must be a string");
+    }
+    if (!token.trim()) {
+        return undefined;
+    }
+    return await principalIdFromIdentityContext(token, options);
+}
+function isIdentityContextUnavailable(error) {
+    if (error instanceof TypeError) {
+        return true;
+    }
+    const code = error && typeof error === "object" && "code" in error
+        ? String(error.code)
+        : "";
+    if (code === "ERR_JWKS_TIMEOUT" || code === "ABORT_ERR") {
+        return true;
+    }
+    const name = error && typeof error === "object" && "name" in error
+        ? String(error.name)
+        : "";
+    if (name === "TimeoutError" || name === "JWKSTimeout") {
+        return true;
+    }
+    if (error instanceof Error) {
+        return /fetch failed|ECONNREFUSED|ENOTFOUND|network|timed out/i.test(error.message);
+    }
+    return false;
+}
+function remoteJwks(env) {
+    const uri = resolveIdentityContextJwksUrl(env);
+    let keySet = jwksCache.get(uri);
+    if (!keySet) {
+        keySet = createRemoteJWKSet(new URL(uri), {
+            timeoutDuration: JWKS_HTTP_TIMEOUT_MS,
+        });
+        jwksCache.set(uri, keySet);
+    }
+    return keySet;
+}
+function principalIdClaim(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return undefined;
+    }
+    return normalizeUuid(value.id);
+}
+//# sourceMappingURL=identity-context.js.map

package/dist/channels/trigger/identity-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-context.js","sourceRoot":"","sources":["../../../src/channels/trigger/identity-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,SAAS,GAEV,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAC5C,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAO,CAAU,CAAC;AAE9D,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAIrE,qEAAqE;AACrE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;AAElD,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,GAAG,6BAA6B,CAAC;IAE9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,IAAI,GAAG,iCAAiC,CAAC;IAElD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAaD,yEAAyE;AACzE,MAAM,UAAU,4BAA4B,CAC1C,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GACP,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC9B,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC9B,0BAA0B,CAAC;IAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,6BAA6B,CAC3C,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,GAAG,4BAA4B,CAAC,GAAG,CAAC,wBAAwB,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAa,EACb,OAAO,GAAiC,EAAE;IAE1C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,2BAA2B,CAAC,2BAA2B,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,MAAgD,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,2BAA2B,CAAC,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,0BAA0B,EAAE,CAAC;QAC9C,MAAM,IAAI,2BAA2B,CACnC,gCAAgC,0BAA0B,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,2BAA2B,CAAC,oCAAoC,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAEjD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;YAC9C,MAAM;YACN,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,CAAC,GAAG,2BAA2B,CAAC;YAC5C,GAAG,EAAE,0BAA0B;YAC/B,cAAc,EAAE,CAAC,KAAK,CAAC;SACxB,CAAC,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,OAAkC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,2BAA2B;YAC5C,KAAK,YAAY,+BAA+B,EAChD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,+BAA+B,CACvC,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;YACnD,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;YAC5C,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,IAAI,KAAK,iBAAiB,IAAI,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;QACvE,CAAC;QACD,IACE,IAAI,KAAK,iCAAiC;YAC1C,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EACnC,CAAC;YACD,MAAM,IAAI,2BAA2B,CAAC,iCAAiC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,2BAA2B,CACnC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,2BAA2B,CAAC,iCAAiC,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;QAChD,MAAM,IAAI,2BAA2B,CACnC,oCAAoC,wBAAwB,EAAE,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,WAAW,GACf,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,aAAa,IAAI,WAAW,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;QAClE,MAAM,IAAI,2BAA2B,CACnC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,aAAa,IAAI,WAAW,CAAC;IACjD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,2BAA2B,CACnC,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAAgC,EAChC,OAAO,GAAiC,EAAE;IAE1C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,2BAA2B,CAAC,mCAAmC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,8BAA8B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IAClD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;QACnD,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;QACnD,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,wDAAwD,CAAC,IAAI,CAClE,KAAK,CAAC,OAAO,CACd,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB;IACxC,MAAM,GAAG,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;YACxC,eAAe,EAAE,oBAAoB;SACtC,CAAC,CAAC;QACH,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,aAAa,CAAE,KAA0B,CAAC,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/channels/trigger/types.d.ts

@@ -10,6 +10,7 @@ declare const messageEventSchema: z.ZodObject<{
     channel_id: z.ZodString;
     source_thread_key: z.ZodString;
     address: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    identity_context: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     type: z.ZodLiteral<"message">;
     input: z.ZodObject<{
         messages: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -23,6 +24,7 @@ declare const interruptResumeEventSchema: z.ZodObject<{
     channel_id: z.ZodString;
     source_thread_key: z.ZodString;
     address: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    identity_context: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     type: z.ZodLiteral<"interrupt_resume">;
     interaction: z.ZodObject<{
         type: z.ZodLiteral<"interrupt_resume">;
@@ -37,6 +39,7 @@ declare const eventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     channel_id: z.ZodString;
     source_thread_key: z.ZodString;
     address: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    identity_context: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     type: z.ZodLiteral<"message">;
     input: z.ZodObject<{
         messages: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -49,6 +52,7 @@ declare const eventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     channel_id: z.ZodString;
     source_thread_key: z.ZodString;
     address: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    identity_context: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     type: z.ZodLiteral<"interrupt_resume">;
     interaction: z.ZodObject<{
         type: z.ZodLiteral<"interrupt_resume">;
@@ -93,6 +97,12 @@ export interface TriggerChannelRuntimeEventRequest {
     address: TriggerChannelAddress;
     run_thread_id: string;
     run_id: string;
+    /**
+     * Safe, user-facing status text. Raw runtime exceptions must never be sent.
+     */
+    message?: {
+        text: string;
+    };
     /**
      * Present on `run.interrupted`. The Trigger Server cannot read the
      * deployment's threads, so pending interrupts travel on the event itself.

package/dist/channels/trigger/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/channels/trigger/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAK1D,uDAAuD;AACvD,QAAA,MAAM,YAAY,wCAAoC,CAAC;AAevD,QAAA,MAAM,kBAAkB;;;;;;;;;;;;iBAKtB,CAAC;AACH,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;iBAM9B,CAAC;AACH,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;2BAGf,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACjE,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,kBAAkB,CAAC,KAAK,CAAC,KAAK,CACtC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC5E,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,0BAA0B,CAClC,CAAC;AACF,6HAA6H;AAC7H,MAAM,MAAM,oBAAoB,GAC9B,kCAAkC,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC9D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAE9D,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,8BAA8B,GACtC,aAAa,GACb,eAAe,GACf,iBAAiB,GACjB,YAAY,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,8BAA8B,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAG5E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/channels/trigger/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAK1D,uDAAuD;AACvD,QAAA,MAAM,YAAY,wCAAoC,CAAC;AAoBvD,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;iBAKtB,CAAC;AACH,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;;iBAM9B,CAAC;AACH,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAGf,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACjE,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,kBAAkB,CAAC,KAAK,CAAC,KAAK,CACtC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC5E,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,0BAA0B,CAClC,CAAC;AACF,6HAA6H;AAC7H,MAAM,MAAM,oBAAoB,GAC9B,kCAAkC,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC9D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAE9D,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,8BAA8B,GACtC,aAAa,GACb,eAAe,GACf,iBAAiB,GACjB,YAAY,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,8BAA8B,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B;;;OAGG;IACH,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAG5E"}

package/dist/channels/trigger/types.js

@@ -19,6 +19,11 @@ const channelEventBase = z.object({
     channel_id: channelId,
     source_thread_key: nonblankString,
     address: opaqueObject,
+    /**
+     * Short-lived Agent Auth identity-context JWT. When present, ingress stamps
+     * its principal UUID as `x-mda-user-id` instead of `mda:channel`.
+     */
+    identity_context: z.string().nullish(),
 });
 const messageEventSchema = channelEventBase.extend({
     type: z.literal("message"),

package/dist/channels/trigger/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/channels/trigger/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE;IAC3E,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AACH,uDAAuD;AACvD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE;IACrD,OAAO,EAAE,cAAc;CACxB,CAAC,CAAC;AACL,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACvB,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,SAAS;IACrB,iBAAiB,EAAE,cAAc;IACjC,OAAO,EAAE,YAAY;CACtB,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;KAChC,CAAC;CACH,CAAC,CAAC;AACH,MAAM,0BAA0B,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACnC,MAAM,EAAE,YAAY;KACrB,CAAC;CACH,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/C,kBAAkB;IAClB,0BAA0B;CAC3B,CAAC,CAAC;AA+DH,mFAAmF;AACnF,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,KAA4B,CAAC;AACtC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/channels/trigger/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE;IAC3E,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AACH,uDAAuD;AACvD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE;IACrD,OAAO,EAAE,cAAc;CACxB,CAAC,CAAC;AACL,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACvB,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,SAAS;IACrB,iBAAiB,EAAE,cAAc;IACjC,OAAO,EAAE,YAAY;IACrB;;;OAGG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CACvC,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;KAChC,CAAC;CACH,CAAC,CAAC;AACH,MAAM,0BAA0B,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACnC,MAAM,EAAE,YAAY;KACrB,CAAC;CACH,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/C,kBAAkB;IAClB,0BAA0B;CAC3B,CAAC,CAAC;AAmEH,mFAAmF;AACnF,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,KAA4B,CAAC;AACtC,CAAC"}

package/dist/connection-authorization.d.ts

@@ -0,0 +1,17 @@
+/** Resolve user-owned connections or interrupt for authorization. */
+import { type AgentAuth } from "./agent-auth.js";
+export interface PendingCredential {
+    slug: string;
+    kind: "oauth2" | "secret";
+    connect_url?: string;
+    auth_id?: string;
+}
+/** Interrupt payload when the caller has not granted one or more connections. */
+export interface CredentialAuthorizationRequiredInterrupt {
+    type: "credential_authorization_required";
+    message: string;
+    credentials: PendingCredential[];
+}
+/** Return user connection material or interrupt once for every missing grant. */
+export declare function resolveUserConnectionGrants(agentAuth: AgentAuth, slugs: readonly string[]): Promise<Map<string, string>>;
+//# sourceMappingURL=connection-authorization.d.ts.map

package/dist/connection-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-authorization.d.ts","sourceRoot":"","sources":["../src/connection-authorization.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAIrE,OAAO,EACL,KAAK,SAAS,EAGf,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,iFAAiF;AACjF,MAAM,WAAW,wCAAwC;IACvD,IAAI,EAAE,mCAAmC,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAQD,iFAAiF;AACjF,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAuC9B"}

package/dist/connection-authorization.js

@@ -0,0 +1,46 @@
+/** Resolve user-owned connections or interrupt for authorization. */
+import { interrupt } from "@langchain/langgraph";
+import { CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+/** Return user connection material or interrupt once for every missing grant. */
+export async function resolveUserConnectionGrants(agentAuth, slugs) {
+    const grants = await Promise.all([...new Set(slugs)].map((slug) => readUserConnectionGrant(agentAuth, slug)));
+    const missingOAuth = grants.filter((grant) => !grant.token && grant.kind === "oauth2");
+    const missingSecret = grants.filter((grant) => !grant.token && grant.kind === "secret");
+    if (missingOAuth.length > 0 || missingSecret.length > 0) {
+        const sessions = await Promise.all(missingOAuth.map((grant) => agentAuth.startAuthorizationSession(grant.slug)));
+        const payload = {
+            type: "credential_authorization_required",
+            message: "Connect the following integrations to continue.",
+            credentials: [
+                ...sessions.map((session) => ({
+                    slug: session.slug,
+                    kind: "oauth2",
+                    connect_url: session.connectUrl,
+                    auth_id: session.authId,
+                })),
+                ...missingSecret.map((grant) => ({
+                    slug: grant.slug,
+                    kind: "secret",
+                })),
+            ],
+        };
+        interrupt(payload);
+        throw new CredentialAuthorizationRequiredError([
+            ...missingOAuth.map((grant) => grant.slug),
+            ...missingSecret.map((grant) => grant.slug),
+        ]);
+    }
+    return new Map(grants.map((grant) => [grant.slug, grant.token]));
+}
+async function readUserConnectionGrant(agentAuth, slug) {
+    const row = await agentAuth.findWorkspaceConnection(slug);
+    if (!row) {
+        throw new CredentialStoreError(`workspace connection ${JSON.stringify(slug)} is not configured`);
+    }
+    const kind = row.kind === "secret" ? "secret" : "oauth2";
+    const token = kind === "secret"
+        ? await agentAuth.readUserSecretForConnection(row)
+        : await agentAuth.readUserAccessTokenForConnection(row);
+    return { slug, kind, token };
+}
+//# sourceMappingURL=connection-authorization.js.map

package/dist/connection-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-authorization.js","sourceRoot":"","sources":["../src/connection-authorization.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAEL,oCAAoC,EACpC,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAsBzB,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAoB,EACpB,KAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAC5E,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAChC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CACnD,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CACjC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CACnD,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzB,SAAS,CAAC,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAChD,CACF,CAAC;QACF,MAAM,OAAO,GAA6C;YACxD,IAAI,EAAE,mCAAmC;YACzC,OAAO,EAAE,iDAAiD;YAC1D,WAAW,EAAE;gBACX,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,QAAiB;oBACvB,WAAW,EAAE,OAAO,CAAC,UAAU;oBAC/B,OAAO,EAAE,OAAO,CAAC,MAAM;iBACxB,CAAC,CAAC;gBACH,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,QAAiB;iBACxB,CAAC,CAAC;aACJ;SACF,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,CAAC;QACnB,MAAM,IAAI,oCAAoC,CAAC;YAC7C,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YAC1C,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAe,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,SAAoB,EACpB,IAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,oBAAoB,CAC5B,wBAAwB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,MAAM,KAAK,GACT,IAAI,KAAK,QAAQ;QACf,CAAC,CAAC,MAAM,SAAS,CAAC,2BAA2B,CAAC,GAAG,CAAC;QAClD,CAAC,CAAC,MAAM,SAAS,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC"}